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The Examiner has required new corrected drawings in compliance with 37 CFR 
1.121(d). Applicant has attached herewith corrected drawings as requested, 



The Examiner has rejected Claims 1-10 under 35 U.S.C. 101 as being directed to 
non-statutory subject matter. Applicant has amended such claims to overcome this 
rejection. 



The Examiner has rejected Claims 1-5, 8-15, 18-25 and 28-30 under 35 U.S.C. 
102(e) as being anticipated by Kuo (U.S. Patent No. 6,230,288). The Examiner has 
further rejected Claims 6-7, 16-17, and 26-27 under 35 U.S.C. 103(a) as being 
unpatentable oveT Kuo in view of Chen (U.S. Patent No. 5,960,170). Applicant 
respectfully disagrees with such rejections, especially in view of the amendments made 
hereinabove to each of the independent claims. 



With respect to each of the independent claims, the Examiner has relied on the 
following excerpt from Kuo to make a prior art showing of applicant's claimed 
"searching code operable to search within said computer file for text data containing one 
or more target words that match at least one of a word or a characteristic of a word within 
a predetermined word library" (see the same or similar, but not identical language in each 
of the independent claims). 



"Storage devices 16 contain a virus detection program 36 (e.g., a 
search engine) and a file containing at least one virus signature 
36. Virus signatures 38 are sequences of computer-readable 
characters that portray viruses found within textual and/or 
executable computer files in that they match the behavior 
exhibited by, or a series of characters found within, known 
viruses. Virue detection program 3 6 comprises computer- readable 
instructions which, when executed by CPU 12, search for viruses 
within computer files on storage devices 16 and/or memory unit 
14. Viruses in these computer files are identified by the 
detection of tell-tale characteristics which match one of virus 
signatures 3 8.* (Kuo-Col. 4, lines 15-27) 
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Applicant notes that the above excerpt relied on by the Examiner only discloses 
virus signatures that are "sequences of computer-readable characters that portray 
viruses." Clearly, a sequence of characters do not rise to the level of specificity of 
applicant's specifically claimed "target words that match at least one of a word or a 
characteristic of a word" (emphasis added), as claimed. To emphasize, Kuo only teaches 
searching for viruses using sequences o f characters, which are not inherently target 
words, in the manner claimed by applicant. 

Still with respect to each of the independent claims, the Examiner has relied on 
the following excerpt from Kuo to make a prior art showing of applicant's claimed 
"context identifying code operable to identify a context within said computer file of said 
one or more target words," 

*In step 52 a user invokes SCAN.BXB to search at least one file 
on computer system 10 for computer viruses. SCAN. EXE opens (step 
54) a first file and determines (step 56) whether the file is an 
executable file (such as an executable program's object code) or 
a text file (such as script, batch, data and word processing 
files)." (Kuo-Col. 6, lines 52-59) 

Applicant notes that the above excerpt relied on by the Examiner merely discloses 
determining a type of the file before searching the file for a virus. Clearly, identifying a 
type of file in such a manner does not meet applicant's specific claim language. First, 
applicant claims identifying "a context within said computer file" (emphasis added) and 
not simply a context of the computer file as Kuo teaches. Second, applicant claims "a 
context. . .of said one or more target words. " (emphasis added) whereas Kuo only teaches 
a type of the file. 

The Examiner is reminded that a claim is anticipated only if each and every 
element as set forth in the claim is found, either expressly or inherently described in a 
single prior art reference. Verdegaal Bros. v. Union Oil Co. Of California, 814 F.2d 628, 
631, 2 USPQ2d 1051, 1053 (Fed. Cir. 1987). Moreover, the identical invention must be 
shown in as complete detail as contained in the claim. Richardson v. Suzuki Motor 
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Co.868 F.2d 1226, 1236, 9USPQ2d 1913, 1920 (Fed. Cir. 1989). The elements must be 
arranged as required by the claim. 

This criterion has simply not been met by the Kuo reference, as noted above. 
Nevertheless, despite such paramount deficiencies and in the spirit of expediting the 
prosecution of the present application, applicant has substantially incorporated, in part, 
the subject matter of Claims 2-3 et al. into each of the independent claims. 

With respect to the subject matter of Claim 2 et al„ as presently incorporated, in 
part, into each of the independent claims, the Examiner has relied on CoL 4 lines 21-22 in 
Kuo to make a prior art showing of applicant's claimed technique "wherein said 
predetermined word library includes one or more of: words that are names associated 
with known malware authors; words that are indicative of being part of a message 
embedded within said computer file by a malware author; word format characteristics 
that are indicative of words being part of a message embedded within said computer file 
by a malware author; and word suffix characteristics that are indicative of words being 
part of a message embedded within said computer file by a malware author. 5 ' 

The Examiner has specifically relied on such excerpt to meet applicant's claimed 
''words that are indicative of being part of a message embedded within said computer file 
by a malware author." However, applicant has removed such language from the Markush 
claim language in each of the independent claims. Thus, applicant respectfully requests a 
prior art showing of applicant's specific claim language, as presently incorporated into 
each of the independent claims. 

With respect to the subject matter of Claim 3 et al., as presently incorporated, in 
part, into each of the independent claims, the Examiner has relied on Col. 6, lines 41-44 
in Kuo to make a prior art showing of applicant's claimed technique "wherein said 
predetermined set of contexts includes one or more of: within a script portion of a 
webpage; within a comment of a webpage; within executable code; and within a 
predetermined proximity to another target word." 
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The Examiner has specifically relied on such excerpt to meet applicant's claimed 
'Svithin executable code." However, applicant has removed such language from the 
Markush claim language in each of the independent claims. Thus, applicant respectfully 
requests a prior art showing of applicant's specific claim language* as presently 
incorporated into each of the independent claims. 

Applicant further notes that the prior art is also deficient with respect to the 
dependent claims. For example, with respect to Claim 6 et al„ the Examiner has relied on 
Col. 12, lines 41-46 in Chen to make a prior art showing of applicant's claimed technique 
"wherein, if said computer file is identified as potentially containing malware, then 
trigger thresholds associated with one or more other malware identifying processes 
applied to said computer file are adjusted to be more sensitive." 

Applicant notes that such excerpt relied on by the Examiner simply discloses that 
"a second scan is undertaken based upon the result of the first scan." The Examiner has 
specifically argued that "the trigger thresholds are more sensitive in that if a file is caught 
in the second scan it has a greater chance of being infected [and] therefore the second 
scan is more sensitive." Applicant respectfully asserts that simply because the second 
scan has a greater chance of identifying an infected file does not inherently mean that the 
scan is more sensitive. 

In Chen, the file is scanned with a second scan to further scan the rest of the data 
in the file not scanned in the first scan, such that it may be positively identified whether 
the file contains a virus. Thus, the second scan is not more sensitive, as the Examiner 
contends, but instead merely scans the rest of the data in the file. Furthemiore, applicant 
respectfully asserts that nowhere in such excerpt is there any teaching of adjusting trigger 
thresholds, as applicant claims. 

With respect to Claim 7 et al., the Examiner has relied on CoL 14, line 58-CoL 15, 
line 16 in Chen to make a prior art showing of applicant's claimed technique "wherein if 
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said computer file is identified as potentially containing malware, then a trigger threshold 
associated with a heuristic malware identifying process applied to said computer file is 
set to a more sensitive level." Specifically, the Examiner has argued that producing the 
virus detection module in Chen increases sensitivity. Applicant respectfully asserts that 
nowhere in such excerpt is there any disclosure of a trigger threshold, as claimed by 
applicant. In fact, in Chen, a new virus detection object is created "based upon the results 
of the execution of previous virus detection objects," whereas applicant claims "a trigger 
threshold .associated with a heuristi c malware identifying process applied to said 
computer file is set to a more sensitive level" (emphasis added), as claimed. Thus, a 
trigger threshold of a process applied to the file is set to a more sensitive level, as claimed 
by applicant, instead of merely making a new detection object, as in Chen. 

With respect to the subject matter of Claim 9 et al., the Examiner has relied on 
Col. 6, lines 41-44 in Kuo to make a prior art showing of applicant's claimed technique 
"wherein only those portions of said computer file matching said predetermined set of 
contexts are searched for said target words." The Examiner has specifically argued that 
the predetermined context is executable code. Applicant respectfully asserts that such 
excerpt only teaches that a "user may choose to search.. .only particular types of files 
(eg., executable, text-based)." Clearly, a user that chooses to search specific types of 
files does not meet applicant's claim language when taken in context. In particular, 
applicant's claimed predetermined set of contexts are compared to "a context within said 
computer file of said one or more target words" (emphasis added) and are not merely a 
tvoe of file chosen by a user, as taught in Kuo. 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all die claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
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prior art and not based on applicant's disclosure. In re Vaeck.947 F.2d 488, 20 USPQ2d 
1438 (Fed.Cir.1991). 

Applicant respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art references, when combined, fail 
to teach or suggest ail of the claim limitations, as noted above. A notice of allowance or 
a proper prior art showing of aU of applicant's claim limitations, in combination with the 
remaining claim elements, is respectfully requested. 

Still yet, applicant brings to the Examiner's attention the subject matter of new 
Claims 31-35 below, which are added for full consideration: 

"wherein said predetermined word library includes: words that are names 
associated with known malware authors; words that are indicative of being part of 
a message embedded within said computer file by a malware author, word format 
characteristics that are indicative of words being part of a message embedded 
within said computer file by a malware author; and word suffix characteristics 
that are indicative of words being part of a message embedded within said 
computer file by a malware author" (see Claim 31); 

wherein said predetermined set of contexts includes: within a script 
portion of a webpage; within a comment of a webpage; within executable code; 
and within a predetermined proximity to another target word" (see Claim 32); 

wherein said words include a phonetic equivalent thereof (see Claim 33); 

"said computer file identified as potentially containing malware is 
prevented from being transmitted outward from a mail server and is further 
analyzed when being transmitted inward to said mail server" (see Claim 34); and 
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"wherein said heuristic malware identifying process is set to a more 
sensitive level by reducing a suspicious activities score required to trigger 
identification of said computer file as containing malware" (see Claim 35). 

Thus, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such independent claims. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5100. The 
Commissioner is authorized to charge any additional fees or credit any overpayment to 
Deposit Account No. 50-1351 (Order No. NAI1P485/0 1.133. 01). 



P.O. Box 721 120 

San Jose, CA 95172-1 120 

408-505-5100 




Re/strati6n No. 41,429 



mbmitted, 
<PC. 
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